Honeypot
A honeypot in the context of smart contracts is a deceptive protocol designed to look like an attractive investment or DeFi tool, but which contains a malicious backdoor meant to trap user funds. Once an unsuspecting user deposits assets into the contract, the developer uses the backdoor to prevent the user from withdrawing, effectively stealing the deposited funds. These are common in the rug-pull ecosystem, often targeting users with high-yield farming opportunities that appear legitimate.
Explain Like I'm 12
A honeypot is like a trap set with a piece of cheese. It looks like a great opportunity to make money, but the moment you try to take your investment out, you find the exit is locked. Only the person who built the trap has the key, allowing them to keep all the money you put in.
Why It Matters
Honeypots are a major source of retail loss in the cryptocurrency space. They destroy trust in new, unverified projects and showcase the risks of 'degen' investing.
How It Works
The developer writes a smart contract where the withdrawal function has a hidden check—typically a whitelist of allowed addresses or a flag that can only be set to 'false.' When users interact with the contract, they are depositing into a pool that they can never pull from, while the developer later triggers a drain function.
Real-World Example
The Squid Game token (SQUID) was a famous honeypot where investors could buy the token but were unable to sell it, causing the price to skyrocket before the developers drained the pool.
Advantages
- Reveals risks of unverified smart contracts
- Encourages community due diligence
- Serves as a cautionary case study for developers
Limitations
- Difficult to detect for average retail users
- Directly results in permanent loss of funds
- Hard to recover stolen assets once drained
Common Misconceptions
- People think that checking the contract balance is enough to spot a scam, but honeypots often show high balances to lure victims.
- Many believe that because a contract is on a major blockchain, it is inherently safe from being a honeypot.
Knowledge Explorer
Explore This Concept in the Knowledge Graph
See how Honeypot connects to other concepts, books, research, and developer resources.
Related Terms
Exit Scam
An exit scam is a fraudulent practice in the cryptocurrency and decentralized finance (DeFi) sectors where the project developers or platform operators abruptly terminate their operations after collecting significant capital from investors. By effectively disappearing with the users' funds—often through the drainage of liquidity pools, the sale of pre-mined tokens, or the closure of centralized exchange platforms—the perpetrators permanently deprive investors of their assets. This form of malicious activity is characterized by premeditated intent to deceive participants under the guise of a legitimate technological endeavor.
Liquidity Pool
A liquidity pool is a crowdsourced collection of digital assets locked in a smart contract to facilitate decentralized trading and lending. Unlike traditional order books where buyers and sellers must be matched, liquidity pools use Automated Market Makers (AMMs) to enable permissionless exchange. By pooling funds, the protocol ensures that there is always a counterparty available for trades, maintaining market depth even for less popular tokens and reducing reliance on centralized intermediaries.
Rug Pull
A rug pull is a malicious maneuver where crypto developers abandon a project and run away with investors' funds. This typically happens in decentralized finance (DeFi) projects, where developers create a token, list it on a decentralized exchange, and lure in investors. Once the liquidity pool reaches a sufficient size, the developers withdraw all the paired liquidity (the 'rug'), causing the token's value to crash to zero and leaving investors with worthless assets.
51% Attack
An attack where one entity or coalition controls enough consensus power to reorganize blocks, censor transactions, or attempt double spending.
Address Poisoning
A scam where attackers create lookalike address activity so victims may accidentally send funds to the wrong address.
Audit
A smart contract audit is a comprehensive, systematic examination of a blockchain project's source code by independent security experts. The goal is to identify vulnerabilities, logical errors, and potential security flaws that could lead to exploits or financial loss. Auditors review the code for compliance with best practices, test for edge cases, and analyze the interaction between different smart contracts to ensure the protocol functions as intended before it is deployed on a mainnet.